Generator v3.0.0 #4
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -10,3 +10,4 @@ mount | |
| **temp | ||
| *key* | ||
| *keys* | ||
| test | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| npm run dev |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -22,6 +22,46 @@ app.use( | |
| ); | ||
| app.use(express.json()); | ||
|
|
||
| // NON_SUBNET mode: when NON_SUBNET=true, block every subnet-management route | ||
| // (including the wizard landing page "/") so only the XDPoS private-network | ||
| // generator (/gen_xdpos, /submit_xdpos) remains reachable. | ||
| const NON_SUBNET = process.env.NON_SUBNET === "true"; | ||
| const SUBNET_ROUTES = [ | ||
| "/", | ||
| "/debug", | ||
| "/state", | ||
| "/deploy_csc_lite", | ||
| "/deploy_csc_full", | ||
| "/deploy_csc_reversefull", | ||
| "/deploy_zero", | ||
| "/deploy_subswap", | ||
| "/start_subnet", | ||
| "/stop_subnet", | ||
| "/start_subnet_slow", | ||
| "/start_services", | ||
| "/stop_services", | ||
| "/start_subswap_frontend", | ||
| "/stop_subswap_frontend", | ||
| "/start_explorer", | ||
| "/stop_explorer", | ||
| "/remove_subnet", | ||
| "/gen", | ||
| "/submit", | ||
| "/submit_preconfig", | ||
| "/faucet", | ||
| "/faucet_subnet", | ||
| ]; | ||
|
|
||
| app.use((req, res, next) => { | ||
| if (NON_SUBNET && SUBNET_ROUTES.includes(req.path)) { | ||
| console.log(`NON_SUBNET: blocked ${req.path}`); | ||
| return res | ||
| .status(403) | ||
| .json({ error: "Subnet routes are disabled (NON_SUBNET mode)" }); | ||
| } | ||
| next(); | ||
|
Comment on lines
+55
to
+62
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf 'Files matching express.js:\n'
fd -a 'express\.js$' . || true
printf '\nRelevant file excerpts:\n'
for f in $(fd 'express\.js$' .); do
echo "--- $f"
wc -l "$f"
sed -n '1,140p' "$f" | cat -n
done
printf '\nSubnet route declarations/usages:\n'
rg -n "SUBNET_ROUTES|/submit|submit|strictRouting|strict routing" container-manager/src || true
printf '\nPackage Express version if available:\n'
fd 'package\.json$' -d 5 . | xargs -r -n1 sh -c 'echo "--- $0"; jq ".dependencies.express, .devDependencies.express" "$0"'Repository: XinFinOrg/Subnet-Deployment Length of output: 50383 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf 'Package.json/lock Express entries (if present):\n'
for f in $(fd 'package(-lock)?\.json$' -d 4 .); do
echo "--- $f"
jq -r '(.dependencies.express?, .devDependencies.express? // keys[]?|select(startswith("express@"))? // "none", (.["express@*"] // {})|keys[]?|select(startswith("express@"))? // "none")|select(type=="string")' "$f" 2>/dev/null || true
done
printf '\nRest of express.js route handlers and strict settings:\n'
sed -n '140,225p' container-manager/src/express.js | cat -n
grep -En "strictRouting|app\(strict|strict\(\)" container-manager/src || true
printf '\nProgrammatic simulation of current middleware vs Express-style non-strict GET routes for /submit and /submit/.submit variants:\n'
python3 - <<'PY'
BLOCKED = ["/submit", "/submit_preconfig", "/debug", "/"]
def current_checks(path):
return path in BLOCKED
def express_like_matches(handler_path, req_path):
if handler_path.endswith("/"):
return req_path == handler_path or (handler_path[:-1] == req_path)
return req_path == handler_path or req_path == handler_path + "/"
handler = "/submit"
for req_path in ["/submit", "/submit/", "/submit.submit", "/submit/submit", "/debug/"]:
print(f"{req_path!r}: blocked={current_checks(req_path)} matching={express_like_matches(handler, req_path)}")
PYRepository: XinFinOrg/Subnet-Deployment Length of output: 3664 🌐 Web query:
💡 Result: In Express.js, both version 4.x and 5.x provide a strict routing option that controls how the router handles trailing slashes in request paths [1][2]. By default, the strict routing option is disabled (false) [1][2]. When it is disabled, Express treats paths with and without a trailing slash (e.g., /foo and /foo/) as identical, meaning they will match the same route [1][2]. When the strict routing option is enabled (true), the router treats /foo and /foo/ as distinct, different routes [1][3]. To enable this behavior, you can pass the strict: true option when creating a router instance [1][2]: const router = express.Router({ strict: true }); This setting applies to the specific router instance. If you are using the main application object as a router, note that Express applications do not typically expose a direct configuration option for strict routing at the app level in the same way, though you can use a mounted router to enforce this behavior for specific sub-paths [1][2]. Citations:
Normalize paths before checking blocked routes. Exact matching lets trailing-slash variants such as 🧰 Tools🪛 ast-grep (0.44.1)[warning] 56-56: Logging request-derived input unsanitized allows log forging (CRLF injection); strip newlines / encode the value before logging. (log-injection-javascript) 🤖 Prompt for AI Agents |
||
| }); | ||
|
|
||
| app.get("/", (req, res) => { | ||
| res.sendFile(path.join(__dirname, "views", "index.html")); | ||
| }); | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| { | ||
| "$schema": "https://raw.githubusercontent.com/NethermindEth/core-scripts/refs/heads/main/schemas/config.json", | ||
| "Init": { | ||
| "ChainSpecPath": "/work/chainspec.json", | ||
| "BaseDbPath": "nethermind_db/xdc-nmc", | ||
| "LogFileName": "xdc.log", | ||
| "StateDbKeyScheme": "Hash", | ||
| "AutoDump": "All" | ||
| }, | ||
| "TxPool": { | ||
| "BlobsSupport": "Disabled" | ||
| }, | ||
| "Sync": { | ||
| "FastSync": true, | ||
| "NeedToWaitForHeader": true, | ||
| "VerifyTrieOnStateSyncFinished": true | ||
| }, | ||
| "Mining": { | ||
| "Enabled": true | ||
| }, | ||
| "JsonRpc": { | ||
| "Enabled": true | ||
| }, | ||
| "Blocks": { | ||
| "TargetBlockGasLimit": 50000000 | ||
| }, | ||
| "Merge": { | ||
| "Enabled": false | ||
| }, | ||
| "TraceStore": { | ||
| "Enabled": false | ||
| } | ||
| } |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Do not ignore every
testpath.A slashless
testpattern recursively ignores any file or directory with that name, which can silently exclude test source. Remove it or scope it to the intended generated artifact.🤖 Prompt for AI Agents